Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-06
Car Dealer (Dealership) and Vehicle sales - Security Vulnerability (CVE-2026-105971)
The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.
PLUGIN
Car Dealer (Dealership) and Vehicle sales
CVE-2026-105971
Risk Score
Threat Entry
Updated 2026-11-05
Litespeed Cache - Security Vulnerability (CVE-2026-93389)
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and…
PLUGIN
Litespeed Cache
CVE-2026-93389
Risk Score
Threat Entry
Updated 2026-11-05
Customer Reviews Woocommerce - Security Vulnerability (CVE-2026-120553)
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Customer Reviews Woocommerce
CVE-2026-120553
Risk Score
Threat Entry
Updated 2026-11-05
Redux Framework - Security Vulnerability (CVE-2026-120533)
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector,…
PLUGIN
Redux Framework
CVE-2026-120533
Risk Score
Threat Entry
Updated 2026-11-05
Give - Security Vulnerability (CVE-2026-118193)
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager…
PLUGIN
Give
CVE-2026-118193
Risk Score
Threat Entry
Updated 2026-11-05
Motors Car Dealership Classified Listings - Security Vulnerability (CVE-2026-116617)
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging…
PLUGIN
Motors Car Dealership Classified Listings
CVE-2026-116617
Risk Score
Threat Entry
Updated 2026-11-05
Redux Framework - Security Vulnerability (CVE-2026-104812)
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied at save time operates only on array leaf values, leaving array keys entirely unsanitized; the injected key is then rendered directly into an id="filelist-" HTML attribute without esc_attr() in…
PLUGIN
Redux Framework
CVE-2026-104812
Risk Score
Threat Entry
Updated 2026-11-05
Wpo365 Login - Security Vulnerability (CVE-2026-122220)
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed SAML message IDs to the wpo365_saml_message_ids transient due to a logic error that returns before saving. Attackers who capture a validly-signed SAMLResponse can replay it to the ACS endpoint repeatedly within its assertion validity window to log in as the victim, including administrators, without detection since the duplicate message ID check never triggers.
PLUGIN
Wpo365 Login
CVE-2026-122220
Risk Score
Threat Entry
Updated 2026-11-04
Invoicing - Security Vulnerability (CVE-2026-119749)
The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to bypass payment processing by submitting a negative item quantity on a public payment form. Attackers can exploit the unchecked quantity value in process_item() to produce a negative line subtotal that reduces the invoice total to zero, causing process_free_payment() to mark the invoice as paid without any actual gateway charge.
PLUGIN
Invoicing
CVE-2026-119749
Risk Score
Threat Entry
Updated 2026-11-04
Invoicing - Security Vulnerability (CVE-2026-119747)
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress post capabilities instead of enforcing the plugin's manage_invoicing permission. Authenticated users with lower-privileged roles such as Editor or Author can exploit this flaw to list other users' invoices, mark pending invoices as paid without recording payment transactions, or create published items and new invoices through the REST API.
PLUGIN
Invoicing
CVE-2026-119747
Risk Score
Threat Entry
Updated 2026-11-04
Invoicing - Security Vulnerability (CVE-2026-119748)
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold.
PLUGIN
Invoicing
CVE-2026-119748
Risk Score
Threat Entry
Updated 2026-11-04
Wepos - Security Vulnerability (CVE-2026-121993)
wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the publish_shop_orders capability (such as Dokan vendor staff) can invoke the payment processing endpoint with an order ID they do not own to trigger the order completion lifecycle, including stock reduction and granting of paid-order access, without making any real payment.
PLUGIN
Wepos
CVE-2026-121993
Risk Score
Threat Entry
Updated 2026-11-04
Sender Net Automated Emails - Security Vulnerability (CVE-2026-119745)
Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to access a sensitive diagnostic dump by requesting the admin_post_sender_debug_download action handled by downloadDebugFile() without any capability, nonce, or referer check. Attackers can exploit this flaw via wp-admin/admin-post.php?action=sender_debug_download to retrieve WordPress, PHP, WooCommerce, and server version details, the full active plugin inventory, active theme information, and plugin settings including the connected Sender account resource key and account metadata.
PLUGIN
Sender Net Automated Emails
CVE-2026-119745
Risk Score
Threat Entry
Updated 2026-11-04
Uncanny Learndash Toolkit - Security Vulnerability (CVE-2026-65555)
Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
PLUGIN
Uncanny Learndash Toolkit
CVE-2026-65555
Risk Score
Threat Entry
Updated 2026-11-04
Woo Vipps - Security Vulnerability (CVE-2026-121970)
Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature verification vulnerability in the recurring-payment webhook handler that allows unauthenticated attackers to forge webhook requests when no local webhook secret is stored, because the code fails to return on an empty secret and computes an HMAC keyed with an empty string using a loose == comparison instead of hash_equals. Attackers can craft a recurring.agreement-stopped.v1 event with a known agreementId and a matching empty-key signature to cancel a victim's active WooCommerce subscription.
PLUGIN
Woo Vipps
CVE-2026-121970
Risk Score
Threat Entry
Updated 2026-11-04
Jetformbuilder - Security Vulnerability (CVE-2026-119481)
Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
PLUGIN
Jetformbuilder
CVE-2026-119481
Risk Score
Threat Entry
Updated 2026-11-04
Newsletter Optin Box - Security Vulnerability (CVE-2026-119468)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2.
PLUGIN
Newsletter Optin Box
CVE-2026-119468
Risk Score
Threat Entry
Updated 2026-11-04
Use Bunnyfont Host Google Fonts - Security Vulnerability (CVE-2026-97397)
The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through…
PLUGIN
Use Bunnyfont Host Google Fonts
CVE-2026-97397
Risk Score
Threat Entry
Updated 2026-11-04
Mobile Builder - Security Vulnerability (CVE-2026-104799)
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *not* contain the substring `'mobile_builder'` because `strpos()` returns `false` on no match and `false == 0` is `true` in PHP — combined with a `permission_callback` (`user_permissions_check`) that grants access to any authenticated…
PLUGIN
Mobile Builder
CVE-2026-104799
Risk Score
Threat Entry
Updated 2026-11-04
Import Users From Csv With Meta - Security Vulnerability (CVE-2026-120554)
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gate that calls `wp_die()` when a non-promoter submits a role. This makes it possible for authenticated attackers holding a custom delegated role with `create_users` but without `promote_users` or `edit_users` to escalate their privileges to Administrator, provided a prior administrator cron-tab save exists and…
PLUGIN
Import Users From Csv With Meta
CVE-2026-120554
Risk Score